PT-2016-3676 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions 1.8.0 through 1.8.3 Foreman versions 1.9.0 through 1.9.0 Description: The issue allows remote authenticated users with the view reports permission to read reports from arbitrary hosts or remote authenticated users with the...

HackerOne: New hacktivity view discloses report IDs of non-public reports

url: https://hackerone.com/hacktivity.json this url reveals information of reporters Report id ./...

Expensify - Expense Reports - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Expensify - Expense Reports published at the 'play' market has multiple vulnerabilities...

HackerOne: New hacktivity view discloses report IDs of non-public reports

The new hacktivity view unintentionally leaked the report IDs of non-public undisclosed reports through react ID's. It has the same root cause as 127620 and was reporter earlier than that, so we decided to award the same bounty. The new hacktivity view unintentionally leaked the report IDs of...

DEBIAN-CVE-2016-1955

Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy CSP violation report that contains path information associated with an IFRAME element...

Mozilla Firefox Sensitive Information Disclosure Vulnerability (CNVD-2016-01683)

Firefox is an open source web browser. Mozilla Firefox suffers from a sensitive information disclosure vulnerability due to Content Security Policy CSP reports containing full path information, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be...

FreeBSD : mozilla -- multiple vulnerabilities (2225c5b4-1e5a-44fc-9920-b3201c384a15)

Mozilla Foundation reports : MFSA 2016-16 Miscellaneous memory safety hazards rv:45.0 / rv:38.7 MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages MFSA 2016-19 Linux video...

chromium-browser: CSP implementation in Blink does not ignore a URL's path component in the case of a ServiceWorker fetch

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

Apache Jetspeed 目录穿越漏洞

通过管理员账号在后台 Portal Site Manger 处 import 恶意构造的 ZIP 文件,ZIP 压缩文件中包含名称为 ../../webapps/de.jsp 的文件,在后台处理 上传时会拼接此文件名导致目录穿越,控制文件上传路径。 poc.zip 包 含 名 为 ../../webapps/ROOT/de.jsp 的 文 件 , 内 容 为 is vulnerable: 上传后,即可在网站根目录根据目标环境决定访问到 de.jsp 文件: 要利用目录穿越上传任意文件虽然需要管理权限的账户,但是通过前一个漏 洞可以轻松创建一个拥有管理者权限的任意账户,再利用此漏洞上传...

CVE-2016-2845

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

Path traversal

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

CVE-2016-2845

Removed by vendor...

UBUNTU-CVE-2016-2845

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

WordPress CP Polls 1.0.8 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: WordPress CP Polls 1.0.8 - CSRF - Update poll settings & Persistent XSS Date: 2016-02-22 Google Dork: Index of /wp-content/plugins/cp-polls/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Plugin URI: http://wordpress.dwbooster.com/forms/cp-polls Version: 1.0.8...

WordPress CP Polls 1.0.8 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress CP Polls 1.0.8 - CSRF - Update poll settings & Persistent XSS Date: 2016-02-22 Google Dork: Index of /wp-content/plugins/cp-polls/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Plugin URI:...

HackerOne: User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions

Poc : 1.Login into Programtestbug as Alice account 2.Create a new group with "Read-only" Permission . Add a Bob to that group 3.Bob report a bug to Programtestbug After Post "Some Internal comments" 4.Now Alice Revoke the Bob team access permissions so Bob is no longer part of the team 5.Bob...

HackerOne: User with Read-Only permissions can edit the SwagAwarded Activities on Bug Reports

Poc : 1.Login into Programtestbug as owner account 2.Create a new group with "Reward" Permission . Add a user to that group 3.Create a new group with "Read-only" Permission . Add a user to that group 3.Login into user account Report a bug to Program testbug 4."Reward" Permission User awarded a sw...

ManageEngine Firewall Analyzer 8.5 - Multiple Vulnerabilities

Exploit for windows platform in category web applications ================================================================ ManageEngine Firewall Analyzer 8.5– Privilege Escalation Vulnerability ================================================================ Description : Vulnerability Type :...

ManageEngine Firewall Analyzer 8.5 - Multiple Vulnerabilities

ManageEngine Firewall Analyzer 8.5 - Multiple Vulnerabilities ================================================================ ManageEngine Firewall Analyzer 8.5– Privilege Escalation Vulnerability ================================================================ Description : Vulnerability Type :...

HackerOne: Increase number of bugs by sending duplicate of your own valid report

HI, This report is a basically a design issue and something similar to report where someone can gain reputations by sending dup. Not very high severity bug and i know you all can always roll back the changes. also it lies more on team rather than a system. but it happened before with me although...